Getting Data In

configured sources for index in inputs.conf

charyjpmc
New Member

Hi All,

I would like to get all the source files configured(in inputs.conf) to particular index. Whether the source is reporting to the index or not, I want to see the values index wise.

Thanks in advance.

0 Karma

deepashri_123
Motivator

Hey charyjpmc,

You can run the following query:
| metadata type=sources index=yourindex

Hope this helps!!!

0 Karma

charyjpmc
New Member

Thanks for reply ..

This query will help me to all the sources but if we have any rolling logs then it bring all those too..
I want only configured logs in inputs.conf file.

0 Karma

FrankVl
Ultra Champion

If you want to get an overview of which inputs are configured to go to which index, I guess you could get that using the btool command:
http://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/Usebtooltotroubleshootconfigurati...

For example: ./splunk cmd btool inputs list

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi charyjpmc,
I'm not sure to understand your need: do you want to send all the inputs in one index?

To do this you have to insert in every room of your inputs.conf

index=my_index

If instead you don't want to insert this option in every room of inputs.conf, you can configure your Indexers to override index value.
To do this, you have to insert in every Indexers or heavy forwarder:
in your props.conf

 [mysourcetype]
 TRANSFORMS-index = overrideindex

in your transforms.conf

 [overrideindex]
 DEST_KEY =_MetaData:Index
 REGEX = .
 FORMAT = my_new_index

In this way, every event with sourcetype=mysourcetype will be sent to my_new_index.

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...